bug: OAuth ignores authorization_servers from Protected Resource Metadata

### Summary

Q CLI's MCP OAuth implementation ignores the `authorization_servers` field from the Protected Resource Metadata (PRM) and derives OAuth endpoints from the MCP server's origin instead. This breaks authentication for MCP servers using external authorization servers.

### Expected Behavior (per MCP OAuth spec)

1. Q CLI fetches PRM → gets `authorization_servers: ["https://external-idp.example.com"]`
2. Q CLI uses external IDP's `/authorize` endpoint ✅

### Actual Behavior

1. Q CLI fetches PRM → gets `authorization_servers: ["https://external-idp.example.com"]`
2. **Q CLI IGNORES `authorization_servers`** ❌
3. Q CLI derives `/authorize` from MCP server's ORIGIN (same host)

### Reproduction

1. Configure MCP server returning PRM with external authorization_servers
2. Add to Q CLI config
3. Observe OAuth URL uses MCP server origin, not external IDP

### Technical Analysis

In `crates/chat-cli/src/mcp_client/oauth_util.rs`, rmcp constructs OAuth endpoints relative to MCP server origin. The `authorization_servers` field from PRM is never used.

`OAuthConfig` only supports `redirect_uri` - no `authUrl`/`tokenUrl` override.

### Impact

- Breaks MCP servers using external authorization servers
- Affects enterprise deployments with custom IDPs
- May relate to #3431 (Figma OAuth)

### Proposed Fix

1. Parse `authorization_servers` from PRM
2. Use first entry as base URL for OAuth endpoints
3. Add `authUrl`/`tokenUrl` to `OAuthConfig`

### Reference

- MCP OAuth spec: https://modelcontextprotocol.io/specification/2025-03-26/basic/authentication